1
0
mirror of https://github.com/php/php-src.git synced 2026-04-28 10:43:30 +02:00
Commit Graph

14831 Commits

Author SHA1 Message Date
Jakub Zelenka d2977b026f Merge branch 'PHP-8.3' into PHP-8.4 2024-12-31 15:20:06 +01:00
Jakub Zelenka 19e2e4d5af Port stream bug51056 and gh11418 tests to use ephemeral ports 2024-12-31 15:18:50 +01:00
Jakub Zelenka e0dabe326f Merge branch 'PHP-8.2' into PHP-8.3 2024-12-31 15:05:18 +01:00
Jakub Zelenka 44a9154e75 Merge branch 'PHP-8.1' into PHP-8.2 2024-12-31 14:39:59 +01:00
Jakub Zelenka b8731767d8 Fix GH-16955: Use empheral ports for OpenSSL server client tests
And refactor some client server tests.

Closes GH-17180
2024-12-31 14:25:19 +01:00
Arnaud Le Blanc 32148e9b10 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add observer temporary to dl'ed functions
2024-12-20 18:50:16 +01:00
Arnaud Le Blanc 9e7932b292 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Add observer temporary to dl'ed functions
2024-12-20 18:46:55 +01:00
Arnaud Le Blanc 6f579934f0 Add observer temporary to dl'ed functions
When observer is enabled, we normally add an extra temporary to all
functions, to store the previously observed frame. However, this is done in
zend_observer_post_startup() so it doesn't happen to dl'ed() functions.

One possible fix would be to move that from zend_observer_post_startup()
to zend_register_functions(), but this would be too early: Observer may
not be enabled when zend_register_functions() is called, and may still be
enabled later.

However, when zend_register_functions() is called at run-time (during dl()),
we know definitively whether observer is enabled.

Here I update zend_register_functions() to add a temporary to dl'ed()
functions when observer is enabled.

Fixes: GH-17211
Closes: GH-17220
2024-12-20 18:45:34 +01:00
Christoph M. Becker a8ffabfc91 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17067: glob:// wrapper doesn't cater to CWD for ZTS builds
2024-12-18 13:04:10 +01:00
Christoph M. Becker 53b69ba8cf Fix GH-17067: glob:// wrapper doesn't cater to CWD for ZTS builds
`glob(3)` doesn't know the virtual CWD of PHP, so we need to pass an
absolute path for ZTS builds.  In lack of a reusable routine, we copy
the code from `glob()` and adapt as needed.

Closes GH-17074.
2024-12-18 13:02:48 +01:00
Christoph M. Becker fd25b79412 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Don't run proc_open_cmd.phpt in parallel with other tests
2024-12-15 12:10:47 +01:00
Christoph M. Becker aafa6ea386 Don't run proc_open_cmd.phpt in parallel with other tests
This test puts a fake cmd.exe in the CWD and removes it only after the
test has finished.  We need to avoid that other tests are running while
that fake cmd.exe is there, because they may use it instead of the
proper cmd.exe.

We also unlink the fake cmd.exe as soon as possible, regardless of the
test result.

Fixes GH-17098.
Closes GH-17090.
2024-12-15 12:09:42 +01:00
David Carlier fc3ac345d7 Merge branch 'PHP-8.3' into PHP-8.4 2024-12-08 20:30:16 +00:00
David Carlier 301b8e24c1 Fix GH-16809: fopen HTTP wrapper timeout stream context option overflow.
close GH-16810
2024-12-08 20:29:57 +00:00
Christoph M. Becker e8bb0a8ba0 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Harden proc_open() against cmd.exe hijacking
2024-12-08 19:10:12 +01:00
Christoph M. Becker 5cbdd5f6de Harden proc_open() against cmd.exe hijacking
As is, whenever `proc_open()` needs to invoke the shell, cmd.exe is
looked up in the usual executable search path.  That implies that any
cmd.exe which is placed in the current working directory (which is not
necessarily what is reported by `getcwd()` for ZTS builds), will be
used.  This is a known attack vector, and Microsoft recommends to
always use the fully qualified path to cmd.exe.

To prevent any cmd.exe in the current working directory to be used, but
to still allow users to use a drop in replacement for cmd.exe, we
search only the `PATH` for cmd.exe (and pass the fully qualified path
to `CreateProcessW`), instead of relying on automatic executable search
by passing the base name only.

To be able to easily test this, we provide a minimalist C file which
will be build as test_helper, and used by the new test case.

[1] <https://msrc.microsoft.com/blog/2014/04/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file/>

Closes GH-17043.
2024-12-08 19:08:02 +01:00
Christoph M. Becker 141ee868c0 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Skip parse_ini_file_variation6.phpt on Windows
2024-12-06 23:53:47 +01:00
Christoph M. Becker 3167c7b1f2 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Skip parse_ini_file_variation6.phpt on Windows
2024-12-06 23:52:47 +01:00
Christoph M. Becker b3b38e2d5c Skip parse_ini_file_variation6.phpt on Windows
While the test obviously succeeds on Windows, it may occasionally
conflict with parse_ini_file_variation6-win32.phpt[1], so we skip it
like we do for many other of these tests which have win32 pendants.

[1] <https://github.com/php/php-src/actions/runs/12077554275/job/33680647284#step:6:119>

Closes GH-16989.
2024-12-06 23:52:03 +01:00
Niels Dossche d6d78545ea Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17037: UAF in user filter when adding existing filter name due to incorrect error handling
2024-12-04 20:05:32 +01:00
Niels Dossche 00f4881e90 Fix GH-17037: UAF in user filter when adding existing filter name due to incorrect error handling
There are two functions that can each fail in their own way. If the last
function fails we have to remove the filter entry from the hash table,
otherwise we risk a UAF. Note also that removing the entry from the
table on failure will also free its memory.

Closes GH-17038.
2024-12-04 20:04:53 +01:00
divinity76 c2d3734e89 Fix GH-15964: printf() can strip sign of -INF
We need to cater to negative infinity explicitly.

Co-authored-by: Christoph M. Becker <cmbecker69@gmx.de>

Closes GH-15965.
2024-12-02 14:27:36 +01:00
Niels Dossche ab7c3b1e7b Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16957: Assertion failure in array_shift with self-referencing array
2024-11-29 19:21:49 +01:00
Niels Dossche f1fc4e8ff7 Fix GH-16957: Assertion failure in array_shift with self-referencing array
We have an RC1 violation because we're immediately dereferencing and
copying the resulting array in the test case. Instead, transfer the
lifetime using RETVAL_COPY_VALUE and unwrap only after the internal
iterator is reset.

Closes GH-16970.
2024-11-29 19:21:11 +01:00
Niels Dossche 3a80936391 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16905: Internal iterator functions can't handle UNDEF properties
2024-11-28 19:22:55 +01:00
Niels Dossche 6a195bd9e7 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16905: Internal iterator functions can't handle UNDEF properties
2024-11-28 19:22:36 +01:00
Niels Dossche e1b4534790 Fix GH-16905: Internal iterator functions can't handle UNDEF properties
Closes GH-16907.
2024-11-28 19:22:10 +01:00
David Warner f086eaa7b8 Add Windows Server 2025 build number
Closes GH-16838.
2024-11-26 13:35:08 +01:00
Christoph M. Becker 8a5fd6c027 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Use another for bug51056.phpt
2024-11-25 22:06:59 +01:00
Christoph M. Becker 0b5de3014a Use another for bug51056.phpt
This port is already used by san_ipv6_peer_matching.phpt, wo we choose
another port which is not explicitly used in our test suite.  The
proper solution would be to use ephemeral ports[1], but our OpenSSL
`ServerClientTestCase` does not support this yet.

[1] <https://github.com/php/php-src/commit/6ab4e330ac032389d370a722e54ee63aafaa9728>

Closes GH-16871.
2024-11-25 22:06:04 +01:00
Christoph M. Becker 053af52835 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix potential conflict of copy_variation5-win32.phpt
2024-11-25 13:50:16 +01:00
Christoph M. Becker 4ceae71954 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix potential conflict of copy_variation5-win32.phpt
2024-11-25 13:49:20 +01:00
Christoph M. Becker 12ef3da381 Fix potential conflict of copy_variation5-win32.phpt
copy_variation1.phpt also creates and deletes a file copy.tmp in the
same folder, so conflicts may occur[1].  We apply a quick fix.

[1] <https://github.com/php/php-src/actions/runs/11902293714/job/33167012826>

Closes GH-16854.
2024-11-25 13:48:50 +01:00
Christoph M. Becker 19e685ecc4 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Skip file_put_contents_variation7.phpt on Windows
2024-11-20 15:51:48 +01:00
Christoph M. Becker 38ec780015 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Skip file_put_contents_variation7.phpt on Windows
2024-11-20 15:50:54 +01:00
Christoph M. Becker 3656a84c39 Skip file_put_contents_variation7.phpt on Windows
While the test obviously succeeds on Windows, it may occasionally
conflict with file_put_contents_variation7-win32.phpt[1], so we skip it
like we do for many other of these tests which have win32 pendants.

[1] <https://github.com/php/php-src/actions/runs/11527743659/job/32093951818>

Closes GH-16722.
2024-11-20 15:50:24 +01:00
Jakub Zelenka 7c96af42b7 Merge branch 'PHP-8.3' into PHP-8.4 2024-11-20 11:14:04 +01:00
Jakub Zelenka ffff27f734 Merge branch 'PHP-8.2' into PHP-8.3 2024-11-20 11:12:19 +01:00
Niels Dossche f3ade203d7 Fix GHSA-r977-prxv-hc43
Move the bound check upwards. Since this doesn't generate output we can
check the bound first.
2024-11-20 11:07:04 +01:00
Jakub Zelenka d7fe40868e Fix GHSA-c5f2-jwm7-mmq2: stream HTTP fulluri CRLF injection 2024-11-20 11:06:02 +01:00
Niels Dossche 81030c9bbb Fix GHSA-r977-prxv-hc43
Move the bound check upwards. Since this doesn't generate output we can
check the bound first.
2024-11-17 19:30:44 +01:00
Jakub Zelenka 426a6d4539 Fix GHSA-c5f2-jwm7-mmq2: stream HTTP fulluri CRLF injection 2024-11-17 19:29:45 +01:00
Gina Peter Banyard e7891838a1 ext/standard: Sync parameter names for fpow() to be identical to pow()
Closes GH-16751
2024-11-11 13:04:46 +00:00
FraOre 7bbf2eae8c [skip ci] Fix array_any() and array_all() descriptions
Closes GH-16731.
2024-11-08 20:02:14 +01:00
Christoph M. Becker 5f5d2c04c3 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix rename_variation12*.phpt parallel test conflicts
2024-11-08 00:25:24 +01:00
Christoph M. Becker 03eeec16f0 Fix rename_variation12*.phpt parallel test conflicts
For rename_variation12.phpt this is actually not necessary, since there
is no rename_variation11.phpt, but we still fix it to be in sync with
rename_variation12-win32.phpt which actually is prone to parallel
conflicts.

(cherry picked from commit d4263ddc40)
2024-11-08 00:24:49 +01:00
Ilija Tovilo 230defc198 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix array going away during sorting
2024-11-04 15:51:24 +01:00
Ilija Tovilo f033cf75e4 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix array going away during sorting
2024-11-04 15:51:03 +01:00
Ilija Tovilo 2bdce61390 Fix array going away during sorting
Fixes GH-16648
Closes GH-16654
2024-11-04 15:50:35 +01:00
Ilija Tovilo 25c0993902 Backport CI fixes to security branches
Closes GH-16469

Working towards GH-16286

commit e0db221143b808d97bc3a44e9f0968c6308794b4
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Oct 25 22:48:20 2024 +0200

    Move CFLAGS into ./configure command for consistency

commit 8ad67768250d181cd7fef30e0c866625bbd8ac94
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Oct 25 22:47:03 2024 +0200

    Also upgrade nightly to macOS 13

commit 58a88ccb9f
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Wed Oct 23 19:07:59 2024 +0200

    Fix call to dc[n]gettext in tests with 0 $category

    This causes a segfault on PHP-8.1

commit 611af05c50
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Dec 8 13:36:52 2023 +0100

    [skip ci] Skip intermittently failing curl test on macOS

    The test fails with "CURL ERROR: 56". I will create an issue for it shortly.

commit ec745178bb
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Wed Oct 23 19:05:32 2024 +0200

    Backport parts of 9999a0c for gettext

    See 9999a0cb75

commit 5ce703496f
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Sun Jul 28 14:34:26 2024 +0200

    Fix CI failure on macOS after Curl update

commit 714a3e7071
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Sat Jul 27 16:09:50 2024 +0200

    Fix CI failure after Curl update (#15124)

commit 4f2eb921b9
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Thu May 23 22:20:37 2024 +0200

    Fix GH-14307: Test curl_basic_024 fails with curl 8.8.0

    Curl changed the behaviour, from the changelog:
      - lib: make protocol handlers store scheme name lowercase curl/curl@c294f9c

    From the docs: "The returned scheme might be upper or lowercase. Do
    comparisons case insensitively."

    Closes GH-14312.

commit 251195b41b
Author: Ayesh Karunaratne <ayesh@aye.sh>
Date:   Thu Feb 1 02:03:55 2024 +0700

    ext/curl: Fix failing tests due to string changes in libcurl 8.6.0

    Upstream libcurl 8.6.0 contains a change[^1] that caused a test failure.
    This fixes it by updating the test's `EXPECTF` to use a regex to account for both string patterns.

    [^1]: https://github.com/curl/curl/commit/45cf4755e71f#diff-a8a54563608f8155973318f4ddb61d7328dab512b8ff2b5cc48cc76979d4204cL1683

    Closes GH-13293.

commit fc5d83f2b1
Author: Christoph M. Becker <cmbecker69@gmx.de>
Date:   Wed Oct 16 22:46:20 2024 +0200

    Prepare for necessary move to macOS 13

    GH will remove macOS 12 runner images as of December 3rd, so we prepare
    for that.

    Besides the obvious need to change the runner, we also suppress a
    couple of warnings, because otherwise the build would fail due to
    `-Werror`.
2024-10-28 15:57:16 +01:00